sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A INPUT -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -s 172.16.0.0/12 -j ACCEPT
sudo iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
sudo iptables -A INPUT -s 169.254.0.0/16 -j ACCEPT
sudo iptables -A INPUT -p tcp --tcp-flags RST RST -j DROP
sudo iptables -A INPUT -p icmp --icmp-type destination-unreachable -j DROP
sudo ip6tables -A INPUT -i lo -j ACCEPT
sudo ip6tables -A INPUT -s fe80::/10 -j ACCEPT
sudo ip6tables -A INPUT -p tcp --tcp-flags RST RST -j DROP
sudo ip6tables -A INPUT -p icmpv6 --icmpv6-type destination-unreachable -j DROP
# sudo iptables -A INPUT -p tcp --dport 54190 -j ACCEPT
# sudo iptables -A INPUT -p udp --dport 54190 -j ACCEPT
# sudo ip6tables -A INPUT -p tcp --dport 54190 -j ACCEPT
# sudo ip6tables -A INPUT -p udp --dport 54190 -j ACCEPT
# sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# sudo ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# sudo iptables -A INPUT -p tcp -j DROP
# sudo iptables -A INPUT -p udp -j DROP
# sudo ip6tables -A INPUT -p tcp -j DROP
# sudo ip6tables -A INPUT -p udp -j DROP


sudo iptables -t nat -N REDSOCKS
sudo ip6tables -t nat -N REDSOCKS


sudo iptables -t nat -A REDSOCKS -d 0.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 10.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 100.64.0.0/10 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 127.0.0.0/8 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 169.254.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 172.16.0.0/12 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 192.168.0.0/16 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 198.18.0.0/15 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 224.0.0.0/4 -j RETURN
sudo iptables -t nat -A REDSOCKS -d 240.0.0.0/4 -j RETURN
sudo ip6tables -t nat -A REDSOCKS -d fe80::/10 -j RETURN

sudo iptables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 9051
sudo ip6tables -t nat -A REDSOCKS -p tcp -j REDIRECT --to-ports 9051
# sudo iptables -t nat -A REDSOCKS -p udp -j REDIRECT --to-ports 9053
# sudo ip6tables -t nat -A REDSOCKS -p udp -j REDIRECT --to-ports 9053

# sudo mkdir /sys/fs/cgroup/proxy.slice
# sudo systemd-run --slice=proxy.slice --scope cat a
sudo iptables -t nat -A OUTPUT -p tcp -m cgroup --path "proxy.slice" -j REDSOCKS
sudo iptables -t nat -A OUTPUT -p udp -m cgroup --path "proxy.slice" -j DNAT --to-destination 127.0.0.1:9053
sudo ip6tables -t nat -A OUTPUT -p tcp -m cgroup --path "proxy.slice" -j REDSOCKS
sudo ip6tables -t nat -A OUTPUT -p udp -m cgroup --path "proxy.slice" -j DNAT --to-destination '[::1]:9053'

# sudo iptables -A OUTPUT -p udp -m cgroup --path "proxy.slice" --dport 53 -j ACCEPT
# sudo iptables -A OUTPUT -p udp -m cgroup --path "proxy.slice" -j DROP
# sudo ip6tables -A OUTPUT -p udp -m cgroup --path "proxy.slice" --dport 53 -j ACCEPT
# sudo ip6tables -A OUTPUT -p udp -m cgroup --path "proxy.slice" -j DROP
# sudo ip6tables -A INPUT -m cgroup --path "proxy.slice" -j DROP
# sudo ip6tables -A OUTPUT -m cgroup --path "proxy.slice" -j DROP
sudo iptables-save -f /etc/iptables/iptables.rules
sudo ip6tables-save -f /etc/iptables/ip6tables.rules
sudo systemctl enable iptables.service
sudo systemctl enable ip6tables.service

sudo iptables -F
sudo iptables -F -t nat
sudo iptables -X -t nat
sudo ip6tables -F -t nat
sudo ip6tables -X -t nat
sudo ip6tables -F
sudo systemctl restart iptables.service
sudo systemctl restart ip6tables.service

# IPv4
ipset create byp4 hash:net family inet hashsize 2048 maxelem 65536
ipset add byp4 0.0.0.0/8
ipset add byp4 10.0.0.0/8
ipset add byp4 100.64.0.0/10
ipset add byp4 127.0.0.0/8
ipset add byp4 169.254.0.0/16
ipset add byp4 172.16.0.0/12
ipset add byp4 192.0.0.0/24
ipset add byp4 192.0.2.0/24
ipset add byp4 192.88.99.0/24
ipset add byp4 192.168.0.0/16
ipset add byp4 198.18.0.0/15
ipset add byp4 198.51.100.0/24
ipset add byp4 203.0.113.0/24
ipset add byp4 224.0.0.0/4
ipset add byp4 240.0.0.0/4

# IPv4
iptables -t mangle -A PREROUTING -m mark --mark 0x438 -j RETURN
iptables -t mangle -A PREROUTING -m set --match-set byp4 dst -j RETURN
iptables -t mangle -A PREROUTING -p tcp -j TPROXY --on-port 9051 --tproxy-mark 1088
iptables -t mangle -A PREROUTING -p udp -j TPROXY --on-port 9053 --tproxy-mark 1088

ip rule add fwmark 1088 table 100
ip route add local default dev lo table 100

# Only for local mode
iptables -t mangle -A OUTPUT -m mark --mark 0x438 -j RETURN
iptables -t mangle -A OUTPUT -m set --match-set byp4 dst -j RETURN
iptables -t mangle -A OUTPUT -p tcp -m cgroup --path "proxy.slice" -j MARK --set-mark 1088
iptables -t mangle -A OUTPUT -p udp -m cgroup --path "proxy.slice" -j MARK --set-mark 1088

ip6tables -A INPUT -m cgroup --path "proxy.slice" -j DROP
ip6tables -A OUTPUT -m cgroup --path "proxy.slice" -j DROP

iptables-save -f /etc/iptables/iptables.rules
ip6tables-save -f /etc/iptables/ip6tables.rules


